Incident feed · ShipSecurely
11 incidents tagged npm, newest first.
On October 14, 2026, Next.js published GHSA-p3m5-59mp-jv5r. Crafted requests to an App Router app that has at least one Server Action can burn CPU until that process stops handling further requests. Patched releases are next 15.5.28 and 16.4.1.
On October 14, 2026, Next.js published GHSA-2464-fhr4-w9xw, which it also labels CVE-2026-96889. A memory bug in an upstream image library can lead to remote code execution when image optimization handles SVG on glibc-based Linux. Patched releases are next 15.5.28 and 16.4.1.
On October 14, 2026, Next.js published GHSA-673q-mjm6-r5xr. App Router apps using Cache Components can hit unauthenticated remote code execution when a use cache function returns multiple typed arrays. Affected next releases are 16.0.0 through 16.4.0, patched in 16.4.1.
On September 30, 2026, Next.js published GHSA-h694-7cp9-m8p3. With Cache Components on, a nested use cache that reads a root param can reuse one value's content for every root param. The leaked value is not attacker-controlled. CVE-2026-103004 says 16.3.0 through 16.3.7 are affected and 16.3.8 is the patch.
On September 30, 2026, Next.js published GHSA-4jqv-mc3x-m676. On a self-hosted Pages Router app, a static or ISR page's cache entry can be replaced with another route's content until it is revalidated. Apps on Vercel are not affected. CVE-2026-94543 says the fixes are next 15.5.27 and 16.3.8.
On September 30, 2026, Next.js listed a low-severity bug in next dev, CVE-2026-94486. From 16.0.0 until 16.3.8, the development server's Model Context Protocol endpoint does not reliably block cross-site requests, so a malicious site open in the developer's browser can read project data. Production does not serve the endpoint. The fix is 16.3.8.
On September 30, 2026, Next.js published GHSA-3w37-wq28-93x7. Pending use cache fills do not separate Draft Mode from a normal request, so an overlapping visitor can receive unpublished content with no login. CVE-2026-94544 says next 16.3.0 before 16.3.8 is affected. The fix is 16.3.8.
On September 30, 2026, Next.js published a high-severity image-optimization bug, CVE-2026-94483. From next 16.0.0 until 16.3.8, an allow-listed remote image URL can be resolved to a private address. Apps with no images.remotePatterns are not affected. The fix is 16.3.8.
On September 30, 2026, Next.js published GHSA-f87g-xv8r-7p7x. On a webpack build, opengraph-image and twitter-image routes ignore dynamicParams, so a request can ask for a dynamic segment left out of generateStaticParams. The advisory lists next from 16.0.0. Upgrade that line to 16.3.8. Turbopack builds are not affected.
On September 30, 2026, Next.js published GHSA-mcj8-r9mp-w47p. An app with a root catch-all page plus static or ISR routes can have its shared response cache poisoned by one unauthenticated request. CVE-2026-94484 says that can swap content between visitors or keep the bad entry until it is replaced. The fixes are next 15.5.27 and 16.3.8.
On September 22, 2026, Next.js published GHSA-vcvr-r3jv-pc5j. The Node.js ImageResponse in next/og can lead to remote code execution when attacker-controlled values are placed in SVG content, attributes, or styles. next 16.2.0 before 16.3.6 is affected. The patched release is 16.3.6.
23 tools · 104 fixes · 29 issue guides · Updated Oct 15, 2026 · Sources: GitHub, Supabase, OWASP, Vercel + 28
